CVE-2024-13466: 
WordPress vulnerability analysis and mitigation

The Automatically Hierarchic Categories in Menu plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-13466) discovered on January 30, 2025. The vulnerability affects all versions up to and including 2.0.7 of the plugin. This security issue exists in the plugin's 'autocategorymenu' shortcode functionality (WordPress Plugin, NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'autocategorymenu' shortcode. The issue has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions and data theft (NVD).

Users should update to a version newer than 2.0.7 when available. The vulnerability was disclosed on January 30, 2025, and affected installations should be updated as soon as a patch is released (NVD).